Claude Code safety checklist: what to check before you install a skill, plugin or mod, or open a cloned repo

Summary

Last updated: November 7, 2026. We update this page when we publish a new review or when Claude Code changes how these features work.

Before you add anything to Claude Code, spend two minutes on the files that decide what it can run. This page lists those checks in one place, one line each, for four situations: installing a skill, installing a plugin, installing a mod, and opening Claude Code in a repo you cloned.

The reason is simple. Each of these can run code or pre-approve tools on your machine, and most of the time it is doing exactly what it says. The checks below are how you tell the difference in a couple of minutes. Each line links to the review where we counted how often it comes up.

Which of the four do you do most often? Start with that section.

The checklist

Before you install a skill

1. Open SKILL.md and look for real steps. A one-line stub, a pointer to another file or unreadable ciphertext means there is nothing to install. This check alone would have caught 128 of the 317 skills our review dropped (skills review).
2. Search it for URLs, API keys and sign-up links. 65 of the 317 dropped skills mainly sent people to a paid API or an ad (skills review).
3. Ask whether it would work on your machine. Hard-coded paths and someone else’s Slack channel mark a personal config; 46 of the 317 dropped skills were one (skills review).
4. Find the scripts the SKILL.md names, and search them for curl, requests, fetch, rm -rf and pip install. 19.4% of the skills in our directory tell Claude to run a bundled script, and 5.4% ship a script that goes online (bundled scripts).
5. Read allowed-tools; a bare Bash means any shell command runs without asking during that turn. 4.6% of directory skills pre-approve Bash for any command (bundled scripts).
6. Search for !`, which runs a command when the skill loads. 0.8% of directory skills do this (bundled scripts).

Before you install a plugin

1. Read hooks/hooks.json, starting with SessionStart and Setup, and the scripts they call. They run when a session starts and their output becomes context for Claude; 16.0% of active plugin repos ship one (plugins).
2. Read .mcp.json and look for npx or uvx servers with no version. Without a version, different code can run with no change to the plugin; 65% of npx-started servers in our sample name none (plugins).
3. Look in bin/, which goes onto the PATH of the shell Claude runs commands in. 9.5% of active plugin repos ship one (plugins).
4. List everything before installing with claude --plugin-dir <plugin folder> plugin details <plugin name>. It reads the files without starting a session (plugins).
5. Decide on auto-update, since an update can change the files you reviewed. Prefer marketplaces that pin each plugin to a commit (plugins).

Before you install a mod

1. Run claude plugin validate ./the-mod and read the calls: line. It reads the code without running it; 39% of public mods start programs and 11% go online (mods review).
2. Read the hooks: line; tool.call with no filter sees every tool call. 36% of public mods do that, and 25% see the prompts you send (mods review).
3. If it hooks tool.check, find where it returns allow and see what it lets through. 11 of 891 public mods approve tool calls for you, all with conditions (mods review).

Before you open Claude Code in a cloned repo

1. List .claude/skills/ and compare the folder names with the commands you type. A project skill named like a built-in command replaces it; 6.3% of active repos have one named review, code-review or security-review (project skills).
2. Read each skill’s allowed-tools, which applies whether or not you trust the folder. 12.6% of active repos ship a project skill that pre-approves any Bash command (project skills).
3. Search the skills for !`, which runs commands as the skill loads. 2.8% of active repos have one (project skills).
4. For a quick look, start with claude -p --bare or --setting-sources user so project skills, hooks and .mcp.json stay unloaded. Both come from the official permissions docs (project skills).

Where the numbers come from

Every number above comes from one of five reviews. We read files as text and ran nothing. Each review explains its sample and its limits.

Review	What we read	Date
We reviewed 783 new Claude Code skills; 317 didn’t make our directory	783 skills new to our directory	November 6, 2026
One in five Claude Code skills runs a bundled script	5,036 directory skills and the 317 dropped ones	November 6, 2026
We read 891 public Claude Code mods before installing any	891 mods from 283 active repos	November 6, 2026
Before you open Claude Code in a cloned repo, check its .claude/skills folder	41,142 project skills in 2,427 active repos	November 6, 2026
What a Claude Code plugin runs before you type	2,688 plugins in 1,961 active repos	November 6, 2026

The percentages describe what public files can do. Almost everything we read was authors configuring their own workflow. The checks are there so you can confirm that quickly.

What to ignore

Star counts and file counts. Popular repos ship demos and test files, and a skill or plugin with dozens of files can be harmless. The lines that matter are in SKILL.md frontmatter, hooks/hooks.json, .mcp.json and the claude plugin validate output.

For skills that have already been through these checks, the AgentCraft skills directory lists 5,101 Claude Code skills, and every community skill is reviewed before it’s listed.

Sources

1. Claude Code docs: Plugin security and trust · official
2. Claude Code docs: Permissions (What runs before you trust a folder) · official
3. Claude Code docs: Skills · official
4. Claude Code docs: Mods (Decide whether to trust a mod) · official